Unsloth loader can run Python even with trust disabled
CVE-2026-93348, scored 8.6, is fixed in Unsloth 2026.8.20 and Unsloth Zoo 2026.8.14.
62
Vendor
Unsloth
- Mentions · 7d1
- Mentions · 30d4
- All mentions11
- First seenAug 26, 2026
- Last mentioned2d ago
Timeline
11 articles · newest firstUnsloth publishes GGUF of NVIDIA Nemotron 3.5 Bolt E4B
The Q4_K_M build has 8B total parameters, 4B effective, and a 64K-token context.
38
What Happens When a Trusted Model Repo Changes? Unsloth Studio Re-Checks Before It Runs
Unsloth Studio re-checks model code, weights, packages, and tools before running a changed trusted repo.
38
unsloth/embeddinggemma-2-GGUF — new model trending #29 on Hugging Face
Unsloth released GGUF weights for Google DeepMind's EmbeddingGemma 2, a 740M multimodal embedding model.
52
Unsloth’s model picker had a code-execution problem
Unsloth Studio executed remote Python when users merely selected a model, letting crafted repos run code on developer machines.
63
Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models
Unsloth patched Studio 2026.6.9 after default remote-code trust let malicious Hugging Face models execute Python on inspection.
62
Benchmarking Qwen3.8 27B quantizations: 4-bit holds up, 1-bit collapses
Quesma benchmarks Qwen3.8 27B quantizations: 4-bit Q4_K_M matches BF16 on key benchmarks while 1-bit collapses to random chance.
55
Jackrong/Qwopus3.8-27B-Flash-GGUF — new model trending #26 on Hugging Face
Community fine-tune Qwopus3.8-27B-Flash, built on Qwen3.8-27B, cuts agent reasoning latency with 12.8% faster decoding and 80.7% MTP acceptance.
35
DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusion-735-882-Heretic-Uncensored-NEO-CODER-MAX-MTP-GGUF — new model trending #8 on Hugging Face
A new Qwen3.8-27B GGUF fine-tune claims ARC-C 735 at 8-bit with thinking tokens cut 2x-10x versus the base model.
42
ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF — new model trending #3 on Hugging Face
ISTA-DASLab releases GSQ-RCO non-uniform GGUF quantizations of Qwen3.8-27B down to 2.5 bpw, with task-lossless IQ3_S matching BF16 benchmark scores.
44
unsloth/Qwen3.8-Flash-Next-GGUF — new model trending #21 on Hugging Face
Qwen released Qwen3.8-Flash-Next, an experimental 125B-parameter open-weight MoE previewing the Qwen4 architecture, with Unsloth shipping optimized GGUF quants.
76
Related CVEs
by mentions- Code injection RCE in Unsloth model loading
Appears with
- Unslothorganization · 5
- Hugging Faceorganization · 4
- llama.cppproduct · 4
- Qwen3.8-27Bai model · 3
- Pillar Securityorganization · 3
- Unsloth Studioproduct · 3
- NVIDIAvendor · 2
- Hugging Facevendor · 2
- NVIDIA-Nemotron-3.5-Bolt-E4Bai model · 1
- GPT-OSS-120B-Highai model · 1
- ISTA-DASLabvendor · 1
- Gemma-4-E4B-itai model · 1
- Qwenvendor · 1
- EmbeddingGemmaai model · 1
- EmbeddingGemma 2ai model · 1
- Quesmaorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.